[C++] CRC Bypass MapleStory V88

On viernes, 3 de septiembre de 2010 0 comentarios

#include

#define CALC_JMPDISTANCE(start, target) (int)(((int)target-(int)start)-5)

int nCRCRegionSize = 0x872501;
DWORD dwCRCRegionStart = 0x00401000;
DWORD dwCRCRegionEnd = dwCRCRegionStart+nCRCRegionSize;

int nCRCReturnSize = 6;
DWORD dwCRCFunction;
DWORD dwCRCReturn;
DWORD dwOpenProcessReturn = (DWORD)OpenProcess + 5;

LPVOID lpvNewCRCRegion;

static const BYTE cbCRCArrayOfBytes[16] = {
0x0F, 0xB6, 0x09, 0x8B,
0x55, 0x14, 0x8B, 0x12,
0x33, 0xD1, 0x81, 0xE2,
0xFF, 0x00, 0x00, 0x00
};
static const WCHAR szCRCMask[] = L"xxxxxxxxxxxxxxxx";

............}


http://www.ziddu.com/download/11506100/crc.rar.html
Read more ...»

Win32 API Imports

On 0 comentarios

Taken from SporeCheat
credits: msdn, pinvoke

Imports System.Threading
Imports System


Module APIFunctions

_
Public Enum PAGE_PROTECTION As UInt32
page_execute = &H10
page_execute_read = &H20
page_execute_readwrite = &H40
page_execute_writecopy = &H80
End Enum

_
Public Enum PAGE_ALLOCATION As UInt32
mem_commit = &H1000
mem_reserve = &H2000
mem_reset = &H80000
End Enum

_
Public Enum PAGE_DEALLOCATION As UInt32
mem_decommit = &H4000
mem_release = &H8000
End Enum

_
Public Enum MESSAGEBOX_TYPE As UInt32
mb_ok = 0
mb_okcancel = 1
mb_abortretryignore = 2
mb_yesnocancel = 3
End Enum


_
Public Enum THREAD_CREATION_FLAGS As UInt32
zero = &H0
create_suspended = &H4
STACK_SIZE_PARAM_IS_A_RESERVATION = &H10000
End Enum

_
Public Enum PROCESS_ACCESS As UInt32
PROCESS_ALL_ACCESS = &H1F0FFF
PROCESS_CREATE_THREAD = &H2
PROCESS_DUP_HANDLE = &H40
PROCESS_QUERY_INFORMATION = &H400
PROCESS_SET_INFORMATION = &H200
PROCESS_TERMINATE = &H1
PROCESS_VM_OPERATION = &H8
PROCESS_VM_READ = &H10
PROCESS_VM_WRITE = &H20
SYNCHRONIZE = &H100000
End Enum



Class User32

Public Declare Auto Function FindWindow Lib "user32" _
(ByVal lpClassName As String, ByVal lpWindowName As String) As IntPtr

Public Declare Auto Function MessageBox Lib "user32" _
(ByVal hWnd As IntPtr, ByVal lpText As String, ByVal lpCaption As String, ByVal MESSAGEBOX_TYPE As UInteger) As Integer




End Class

Class Kernel32

Public Declare Auto Function WriteProcessMemory Lib "kernel32" _
(ByVal hProc As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As Byte(), ByVal nSize As UIntPtr, ByRef lpNumberOfBytesWritten As IntPtr) As Boolean

Public Declare Auto Function VirtualProtectEx Lib "kernel32" _
(ByVal hProc As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As UInteger, ByVal PAGE_PROTECTION As UInteger, ByVal lpflOldProtect As UInteger) As Boolean

Public Declare Auto Function VirtualAllocEx Lib "kernel32" _
(ByVal hProc As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As ULong, ByVal PAGE_ALLOCATION As UInteger, ByVal PAGE_PROTECTION As UInteger) As IntPtr

Public Declare Auto Function VirtualFreeEx Lib "kernel32" _
(ByVal hProc As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As ULong, ByVal PAGE_DEALLOCATION As UInteger) As Boolean

Public Declare Auto Function OpenProcess Lib "kernel32" _
(ByVal dwDesiredAccess As PROCESS_ACCESS, ByVal InheritHandle As Integer, ByVal dwProcessId As UInteger) As IntPtr

Public Declare Ansi Function GetProcAddress Lib "kernel32" _
(ByVal hModule As IntPtr, ByVal lpProcName As String) As IntPtr

Public Declare Auto Function GetModuleHandle Lib "kernel32" _
(ByVal lpModuleName As String) As IntPtr

Public Declare Auto Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" _
(ByVal lpLibFileName As String) As IntPtr

Public Declare Auto Function FreeLibrary Lib "kernel32" _
(ByVal lpLibFileName As Long) As IntPtr

Public Declare Auto Function CreateRemoteThread Lib "kernel32" _
(ByVal ProcessHandle As IntPtr, ByVal lpThreadAttributes As IntPtr, ByVal dwStackSize As UInteger, ByVal lpStartAddress As IntPtr, ByVal lpParamater As IntPtr, ByVal dwCreationFlags As UInteger, ByVal lpThreadID As IntPtr) As IntPtr

End Class


End Module
Read more ...»

[Tut] CRC bypass script

On 0 comentarios

hii all this my 1st time post the thread...
k lets start....

1. get UCE that support loadbinary func.......
2. Open ur UCE and attach maple on it....
3. Go to memory view n click 'save memory region"
4. put this address 00400000 at "From" text box
5. n 00780000 at "To" text box
6. tick "Don`t include *blablablabla header"
(* ur UCE name)
7. Press ADD button and save "crc.cem" in ur UCE folder
8. open "Auto Assemble" n put below script and assign to cheat table and name whatever u want.......

[enable]
alloc(newmem,2048)
alloc(blaaaa,3670018)
label(originalcode)
loadbinary(blaaaa,crc.CEM)
//Modded for .32 by Monouk

newmem:
cmp ecx,00400000
jb originalcode

cmp ecx,00780000
ja originalcode

mov eax,blaaaa
sub eax,00400000
add ecx, eax

originalcode:
mov eax,[ebp+10]
push esi
push edi
jmp 00451cbf

00451cba:
jmp newmem

[disable]
00451cba:
mov eax,[ebp+10]
push esi
push edi
dealloc(newmem)
dealloc(blaaaa)


9. U done Bypass crc script
10 . to use it just enable/tick ur crc script at cheat table before u active ur AA Tool

enjoy..................


edit: Credit go to Monouk, Demonday and who make the tutorial for CRC bypass
Read more ...»

Guy's Detours

On 0 comentarios

This mechanism relies on a unique method of hooking using vectored-exception handling (VEH), which allows you to detour functions without having to preserve registers (e.g. Which is usually done through using pushad/popad), or worry about other potential issues, such as corrupting the stack.

The concept of how it works is displayed below:



Attached is the project.

Fetching parameters can be done by accessing the ESP context pointer (That's for x86; if you're building for x64, access the RSP pointer), like so:



Esp + 4 is the location of the first parameter; Esp holds the return address.

I also added a macro that makes editing flags rather easy, like so:


The above sets the sign flag bit to 1; you just hand off the PCONTEXT pointer as the first argument to EFLAGS, and use the available flags.

Many thanks to everyone here on GameDeception for all the help in '09!

http://www.ziddu.com/download/11505981/GDetour.zip.html
Read more ...»

Tutorial Ganar mas de 100 Gps 1vs1 en Jewel en GunBound

On 0 comentarios

Usando nuestro trainer




Bueno esta forma es un poco complicada porque casi siempre al finalizar el juego sale error.
Pero halle una forma q si me funciona bien, ojala les funcione a uds tambien.

OJO
-
Siempre el master es el q pierde, osea q la cuenta q kieres q gane no tiene q ser master obviamente :).
- El master tiene que estar en el lado Azul
- El master no tiene que matar ningun Raon, dispara al aire o a cualquier lugar.

Paso 1:Buscas un compañero o una cuenta polla para hacer esto; los dos tiene q estar con el trainer GzT .

Entonces:
Cuenta 1 = cuenta polla
Cuenta 2 = cuenta con la que vamos a ganar los 100 gps

Paso 2: (con esta te va salir error)
ahora la la cuenta 2 crea una sala jewel 1vs1 y le damos rdy, ya en el juego empezando la partida el master presiona Alt + H de 25 a 30 veces maximo o te botara el GB. La cuenta 1 tiene q matar minimo un raon con dual , ahora el master tiene que presionar ALT + K en su turno.
entonces al finalizar, en los resultados te va salir error y nadie ganara.

Paso 3: ( los 100 Gps)
Ahora en la sala el master sale(cuenta 2) y se quedaria como master la cuenta 1 (la cta polla), y regresa ala sala la cuenta 2, entonces ahora si hacemos lo mismo que en el paso 2. Y al finalizar veran los resultados.

NO SE OLVIDEN Q EL MASTER TIENE Q ESTAR EN EL LADO AZUL SIEMPRE

Read more ...»